{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1204.002 Malicious File","home_page_url":"https://patchfirst.co/technique/T1204.002/","feed_url":"https://patchfirst.co/feed/technique/T1204.002.json","description":"New and newly exploited CVEs that lead to ATT&CK T1204.002 Malicious File, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-86950#kev","url":"https://patchfirst.co/cve/CVE-2026-86950/","title":"[KEV] CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2026-09-29. ENISA EUVD lists it as exploited. EPSS 26.2% (higher than 98% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 78.8 of 100.","summary":"Apple Multiple Products Out-of-Bounds Write Vulnerability","date_published":"2026-09-29T00:00:00.000Z","date_modified":"2026-10-27T12:29:30.000Z","tags":["kev","public-exploit","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":78.8,"kev":{"dateAdded":"2026-09-29","ransomware":false},"epss":{"score":0.26166,"percentile":0.97992},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2009-3459#kev","url":"https://patchfirst.co/cve/CVE-2009-3459/","title":"[KEV] CVE-2009-3459: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability","content_text":"Adobe · Acrobat and Reader. In CISA KEV since 2026-05-20. ENISA EUVD lists it as exploited. EPSS 86.6% (higher than 99.74% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1203 Exploitation for Client Execution; T1204.002 Malicious File. Priority 69.1 of 100.","summary":"Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability","date_published":"2026-05-20T00:00:00.000Z","date_modified":"2026-06-16T23:11:38.000Z","tags":["kev","public-exploit","T1203","T1204.002"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2026-05-20","ransomware":false},"epss":{"score":0.86646,"percentile":0.9974},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Acrobat and Reader","techniqueIds":["T1203","T1204.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-32202#kev","url":"https://patchfirst.co/cve/CVE-2026-32202/","title":"[KEV] CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-04-28. ENISA EUVD lists it as exploited. EPSS 70.9% (higher than 99.4% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1036 Masquerading. Priority 70.9 of 100.","summary":"Microsoft Windows Protection Mechanism Failure Vulnerability","date_published":"2026-04-28T00:00:00.000Z","date_modified":"2026-10-26T21:10:00.000Z","tags":["kev","public-exploit","T1204.002","T1036"],"_patchfirst":{"reason":"kev","priority":70.9,"kev":{"dateAdded":"2026-04-28","ransomware":false},"epss":{"score":0.70902,"percentile":0.99399},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1036"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2009-0238#kev","url":"https://patchfirst.co/cve/CVE-2009-0238/","title":"[KEV] CVE-2009-0238: Microsoft Office Remote Code Execution","content_text":"Microsoft · Office. In CISA KEV since 2026-04-14. ENISA EUVD lists it as exploited. EPSS 42.9% (higher than 98.7% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 63.9 of 100.","summary":"Microsoft Office Remote Code Execution","date_published":"2026-04-14T00:00:00.000Z","date_modified":"2026-06-16T23:04:33.000Z","tags":["kev","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":63.9,"kev":{"dateAdded":"2026-04-14","ransomware":false},"epss":{"score":0.42941,"percentile":0.98719},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Office","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-9715#kev","url":"https://patchfirst.co/cve/CVE-2020-9715/","title":"[KEV] CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability","content_text":"Adobe · Acrobat. In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 33.5% (higher than 98.4% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 73.1 of 100.","summary":"Adobe Acrobat Use-After-Free Vulnerability","date_published":"2026-04-13T00:00:00.000Z","date_modified":"2026-06-17T03:28:26.000Z","tags":["kev","public-exploit","T1204.002","T1203"],"_patchfirst":{"reason":"kev","priority":73.1,"kev":{"dateAdded":"2026-04-13","ransomware":false},"epss":{"score":0.33491,"percentile":0.98377},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Acrobat","techniqueIds":["T1204.002","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-34621#kev","url":"https://patchfirst.co/cve/CVE-2026-34621/","title":"[KEV] CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability","content_text":"Adobe · Acrobat and Reader. In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 7.2% (higher than 94.3% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 72.9 of 100.","summary":"Adobe Acrobat and Reader Prototype Pollution Vulnerability","date_published":"2026-04-13T00:00:00.000Z","date_modified":"2026-10-26T21:10:00.000Z","tags":["kev","public-exploit","T1204.002","T1203"],"_patchfirst":{"reason":"kev","priority":72.9,"kev":{"dateAdded":"2026-04-13","ransomware":false},"epss":{"score":0.0723,"percentile":0.94317},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Acrobat and Reader","techniqueIds":["T1204.002","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2012-1854#kev","url":"https://patchfirst.co/cve/CVE-2012-1854/","title":"[KEV] CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability","content_text":"Microsoft · Visual Basic for Applications (VBA). In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 20.9% (higher than 97.5% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1574.001 DLL. Priority 63.0 of 100.","summary":"Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability","date_published":"2026-04-13T00:00:00.000Z","date_modified":"2026-06-16T23:40:25.000Z","tags":["kev","T1204.002","T1574.001"],"_patchfirst":{"reason":"kev","priority":63,"kev":{"dateAdded":"2026-04-13","ransomware":false},"epss":{"score":0.20867,"percentile":0.97547},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Visual Basic for Applications (VBA)","techniqueIds":["T1204.002","T1574.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-43520#kev","url":"https://patchfirst.co/cve/CVE-2025-43520/","title":"[KEV] CVE-2025-43520: Apple Multiple Products Classic Buffer Overflow Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2026-03-20. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 36.8% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation; T1499.004 Application or System Exploitation. Priority 59.2 of 100.","summary":"Apple Multiple Products Classic Buffer Overflow Vulnerability","date_published":"2026-03-20T00:00:00.000Z","date_modified":"2026-10-07T11:10:00.000Z","tags":["kev","public-exploit","T1204.002","T1068","T1499.004"],"_patchfirst":{"reason":"kev","priority":59.2,"kev":{"dateAdded":"2026-03-20","ransomware":false},"epss":{"score":0.00425,"percentile":0.36797},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1068","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-43510#kev","url":"https://patchfirst.co/cve/CVE-2025-43510/","title":"[KEV] CVE-2025-43510: Apple Multiple Products Improper Locking Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2026-03-20. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 29.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 54.3 of 100.","summary":"Apple Multiple Products Improper Locking Vulnerability","date_published":"2026-03-20T00:00:00.000Z","date_modified":"2026-10-07T11:10:00.000Z","tags":["kev","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":54.3,"kev":{"dateAdded":"2026-03-20","ransomware":false},"epss":{"score":0.00355,"percentile":0.29265},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-41974#kev","url":"https://patchfirst.co/cve/CVE-2023-41974/","title":"[KEV] CVE-2023-41974: Apple iOS and iPadOS Use-After-Free Vulnerability","content_text":"Apple · iOS and iPadOS. In CISA KEV since 2026-03-05. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 69.5 of 100.","summary":"Apple iOS and iPadOS Use-After-Free Vulnerability","date_published":"2026-03-05T00:00:00.000Z","date_modified":"2026-06-17T06:23:10.000Z","tags":["kev","public-exploit","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":69.5,"kev":{"dateAdded":"2026-03-05","ransomware":false},"epss":{"score":0.01955,"percentile":0.80242},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"iOS and iPadOS","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21385#kev","url":"https://patchfirst.co/cve/CVE-2026-21385/","title":"[KEV] CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2026-03-03. ENISA EUVD lists it as exploited. EPSS 1.3% (higher than 70.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 67.6 of 100.","summary":"Qualcomm Multiple Chipsets Memory Corruption Vulnerability","date_published":"2026-03-03T00:00:00.000Z","date_modified":"2026-06-17T10:18:36.000Z","tags":["kev","public-exploit","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":67.6,"kev":{"dateAdded":"2026-03-03","ransomware":false},"epss":{"score":0.01316,"percentile":0.70731},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-15556#kev","url":"https://patchfirst.co/cve/CVE-2025-15556/","title":"[KEV] CVE-2025-15556: Notepad++ Download of Code Without Integrity Check Vulnerability","content_text":"Notepad++ · Notepad++. In CISA KEV since 2026-02-12. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.8% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1557 Adversary-in-the-Middle; T1204.002 Malicious File. Priority 68.8 of 100.","summary":"Notepad++ Download of Code Without Integrity Check Vulnerability","date_published":"2026-02-12T00:00:00.000Z","date_modified":"2026-06-17T08:38:01.000Z","tags":["kev","public-exploit","T1557","T1204.002"],"_patchfirst":{"reason":"kev","priority":68.8,"kev":{"dateAdded":"2026-02-12","ransomware":false},"epss":{"score":0.01746,"percentile":0.77785},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Notepad++","product":"Notepad++","techniqueIds":["T1557","T1204.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21514#kev","url":"https://patchfirst.co/cve/CVE-2026-21514/","title":"[KEV] CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability","content_text":"Microsoft · Office. In CISA KEV since 2026-02-10. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.6% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1211 Exploitation for Stealth. Priority 68.6 of 100.","summary":"Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability","date_published":"2026-02-10T00:00:00.000Z","date_modified":"2026-06-17T10:18:45.000Z","tags":["kev","public-exploit","T1204.002","T1211"],"_patchfirst":{"reason":"kev","priority":68.6,"kev":{"dateAdded":"2026-02-10","ransomware":false},"epss":{"score":0.01587,"percentile":0.75584},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Office","techniqueIds":["T1204.002","T1211"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21509#kev","url":"https://patchfirst.co/cve/CVE-2026-21509/","title":"[KEV] CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability","content_text":"Microsoft · Office. In CISA KEV since 2026-01-26. ENISA EUVD lists it as exploited. EPSS 70.8% (higher than 99.4% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1211 Exploitation for Stealth. Priority 73.3 of 100.","summary":"Microsoft Office Security Feature Bypass Vulnerability","date_published":"2026-01-26T00:00:00.000Z","date_modified":"2026-06-25T05:16:53.000Z","tags":["kev","public-exploit","T1204.002","T1211"],"_patchfirst":{"reason":"kev","priority":73.3,"kev":{"dateAdded":"2026-01-26","ransomware":false},"epss":{"score":0.70795,"percentile":0.99398},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Office","techniqueIds":["T1204.002","T1211"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2009-0556#kev","url":"https://patchfirst.co/cve/CVE-2009-0556/","title":"[KEV] CVE-2009-0556: Microsoft Office PowerPoint Code Injection Vulnerability","content_text":"Microsoft · Office. In CISA KEV since 2026-01-07. ENISA EUVD lists it as exploited. EPSS 67.3% (higher than 99.3% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1204.002 Malicious File. Priority 64.0 of 100.","summary":"Microsoft Office PowerPoint Code Injection Vulnerability","date_published":"2026-01-07T00:00:00.000Z","date_modified":"2026-06-16T23:05:17.000Z","tags":["kev","T1059","T1204.002"],"_patchfirst":{"reason":"kev","priority":64,"kev":{"dateAdded":"2026-01-07","ransomware":false},"epss":{"score":0.67312,"percentile":0.99303},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Office","techniqueIds":["T1059","T1204.002"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2011-3402#kev","url":"https://patchfirst.co/cve/CVE-2011-3402/","title":"[KEV] CVE-2011-3402: Microsoft Windows Remote Code Execution Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-10-06. ENISA EUVD lists it as exploited. EPSS 78.1% (higher than 99.58% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 79.1 of 100.","summary":"Microsoft Windows Remote Code Execution Vulnerability","date_published":"2025-10-06T00:00:00.000Z","date_modified":"2026-06-16T23:33:14.000Z","tags":["kev","public-exploit","T1204.002","T1203"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2025-10-06","ransomware":false},"epss":{"score":0.78138,"percentile":0.99577},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-48384#kev","url":"https://patchfirst.co/cve/CVE-2025-48384/","title":"[KEV] CVE-2025-48384: Git Link Following Vulnerability","content_text":"Git · Git. In CISA KEV since 2025-08-25. ENISA EUVD lists it as exploited. EPSS 4.4% (higher than 91.3% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 66.9 of 100.","summary":"Git Link Following Vulnerability","date_published":"2025-08-25T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","public-exploit","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":66.9,"kev":{"dateAdded":"2025-08-25","ransomware":false},"epss":{"score":0.04379,"percentile":0.91273},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"Git","product":"Git","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-8088#kev","url":"https://patchfirst.co/cve/CVE-2025-8088/","title":"[KEV] CVE-2025-8088: RARLAB WinRAR Path Traversal Vulnerability","content_text":"RARLAB · WinRAR. In CISA KEV since 2025-08-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS 94.0% (higher than 99.85% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 79.1 of 100.","summary":"RARLAB WinRAR Path Traversal Vulnerability","date_published":"2025-08-12T00:00:00.000Z","date_modified":"2026-08-11T04:17:18.000Z","tags":["kev","ransomware","public-exploit","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2025-08-12","ransomware":true},"epss":{"score":0.94008,"percentile":0.99846},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"RARLAB","product":"WinRAR","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2007-0671#kev","url":"https://patchfirst.co/cve/CVE-2007-0671/","title":"[KEV] CVE-2007-0671: Microsoft Office Excel Remote Code Execution Vulnerability","content_text":"Microsoft · Office. In CISA KEV since 2025-08-12. ENISA EUVD lists it as exploited. EPSS 43.2% (higher than 98.7% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 63.9 of 100.","summary":"Microsoft Office Excel Remote Code Execution Vulnerability","date_published":"2025-08-12T00:00:00.000Z","date_modified":"2026-06-16T22:36:02.000Z","tags":["kev","T1204.002","T1203"],"_patchfirst":{"reason":"kev","priority":63.9,"kev":{"dateAdded":"2025-08-12","ransomware":false},"epss":{"score":0.43241,"percentile":0.98725},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Office","techniqueIds":["T1204.002","T1203"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-21479#kev","url":"https://patchfirst.co/cve/CVE-2025-21479/","title":"[KEV] CVE-2025-21479: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","content_text":"Qualcomm · Multiple Chipsets. In CISA KEV since 2025-06-03. ENISA EUVD lists it as exploited. EPSS 0.8% (higher than 56% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 60.2 of 100.","summary":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","date_published":"2025-06-03T00:00:00.000Z","date_modified":"2026-06-17T08:43:33.000Z","tags":["kev","public-exploit","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":60.2,"kev":{"dateAdded":"2025-06-03","ransomware":false},"epss":{"score":0.00783,"percentile":0.55989},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Qualcomm","product":"Multiple Chipsets","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-43573#kev","url":"https://patchfirst.co/cve/CVE-2024-43573/","title":"[KEV] CVE-2024-43573: Microsoft Windows MSHTML Platform Spoofing Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-10-08. ENISA EUVD lists it as exploited. EPSS 46.1% (higher than 98.8% of CVEs). CVSS 8.1 HIGH. ATT&CK: T1204.002 Malicious File; T1036 Masquerading. Priority 63.4 of 100.","summary":"Microsoft Windows MSHTML Platform Spoofing Vulnerability","date_published":"2024-10-08T00:00:00.000Z","date_modified":"2026-06-17T07:51:19.000Z","tags":["kev","T1204.002","T1036"],"_patchfirst":{"reason":"kev","priority":63.4,"kev":{"dateAdded":"2024-10-08","ransomware":false},"epss":{"score":0.46109,"percentile":0.98809},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-43572#kev","url":"https://patchfirst.co/cve/CVE-2024-43572/","title":"[KEV] CVE-2024-43572: Microsoft Windows Management Console Remote Code Execution Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-10-08. ENISA EUVD lists it as exploited. EPSS 66.7% (higher than 99.29% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 63.3 of 100.","summary":"Microsoft Windows Management Console Remote Code Execution Vulnerability","date_published":"2024-10-08T00:00:00.000Z","date_modified":"2026-06-17T07:51:19.000Z","tags":["kev","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":63.3,"kev":{"dateAdded":"2024-10-08","ransomware":false},"epss":{"score":0.66695,"percentile":0.99288},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-38226#kev","url":"https://patchfirst.co/cve/CVE-2024-38226/","title":"[KEV] CVE-2024-38226: Microsoft Publisher Protection Mechanism Failure Vulnerability","content_text":"Microsoft · Publisher. In CISA KEV since 2024-09-10. ENISA EUVD lists it as exploited. EPSS 2.7% (higher than 85.7% of CVEs). CVSS 7.3 HIGH. ATT&CK: T1204.002 Malicious File. Priority 60.3 of 100.","summary":"Microsoft Publisher Protection Mechanism Failure Vulnerability","date_published":"2024-09-10T00:00:00.000Z","date_modified":"2026-08-10T16:19:04.000Z","tags":["kev","T1204.002"],"_patchfirst":{"reason":"kev","priority":60.3,"kev":{"dateAdded":"2024-09-10","ransomware":false},"epss":{"score":0.02667,"percentile":0.85717},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Publisher","techniqueIds":["T1204.002"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2016-3714#kev","url":"https://patchfirst.co/cve/CVE-2016-3714/","title":"[KEV] CVE-2016-3714: ImageMagick Improper Input Validation Vulnerability","content_text":"ImageMagick · ImageMagick. In CISA KEV since 2024-09-09. ENISA EUVD lists it as exploited. EPSS 97.5% (higher than 99.9% of CVEs). CVSS 8.4 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 68.9 of 100.","summary":"ImageMagick Improper Input Validation Vulnerability","date_published":"2024-09-09T00:00:00.000Z","date_modified":"2026-06-17T00:46:14.000Z","tags":["kev","public-exploit","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2024-09-09","ransomware":false},"epss":{"score":0.97485,"percentile":0.999},"cvss":{"score":8.4,"severity":"HIGH","version":"3.1"},"vendor":"ImageMagick","product":"ImageMagick","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-7262#kev","url":"https://patchfirst.co/cve/CVE-2024-7262/","title":"[KEV] CVE-2024-7262: Kingsoft WPS Office Path Traversal Vulnerability","content_text":"Kingsoft · WPS Office. In CISA KEV since 2024-09-03. ENISA EUVD lists it as exploited. EPSS 3.1% (higher than 87.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1574.001 DLL. Priority 61.0 of 100.","summary":"Kingsoft WPS Office Path Traversal Vulnerability","date_published":"2024-09-03T00:00:00.000Z","date_modified":"2026-06-17T08:19:43.000Z","tags":["kev","T1204.002","T1574.001"],"_patchfirst":{"reason":"kev","priority":61,"kev":{"dateAdded":"2024-09-03","ransomware":false},"epss":{"score":0.03058,"percentile":0.87581},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Kingsoft","product":"WPS Office","techniqueIds":["T1204.002","T1574.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-38189#kev","url":"https://patchfirst.co/cve/CVE-2024-38189/","title":"[KEV] CVE-2024-38189: Microsoft Project Remote Code Execution Vulnerability","content_text":"Microsoft · Project. In CISA KEV since 2024-08-13. ENISA EUVD lists it as exploited. EPSS 8.2% (higher than 94.9% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 63.1 of 100.","summary":"Microsoft Project Remote Code Execution Vulnerability","date_published":"2024-08-13T00:00:00.000Z","date_modified":"2026-06-17T07:39:38.000Z","tags":["kev","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":63.1,"kev":{"dateAdded":"2024-08-13","ransomware":false},"epss":{"score":0.08194,"percentile":0.94865},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Project","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-38080#kev","url":"https://patchfirst.co/cve/CVE-2024-38080/","title":"[KEV] CVE-2024-38080: Microsoft Windows Hyper-V Privilege Escalation Vulnerability","content_text":"Microsoft · Windows . In CISA KEV since 2024-07-09. ENISA EUVD lists it as exploited. EPSS 7.1% (higher than 94.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 67.3 of 100.","summary":"Microsoft Windows Hyper-V Privilege Escalation Vulnerability","date_published":"2024-07-09T00:00:00.000Z","date_modified":"2026-06-17T07:39:22.000Z","tags":["kev","public-exploit","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":67.3,"kev":{"dateAdded":"2024-07-09","ransomware":false},"epss":{"score":0.07058,"percentile":0.94196},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows ","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-29988#kev","url":"https://patchfirst.co/cve/CVE-2024-29988/","title":"[KEV] CVE-2024-29988: Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability","content_text":"Microsoft · SmartScreen Prompt. In CISA KEV since 2024-04-30. ENISA EUVD lists it as exploited. EPSS 45.2% (higher than 98.8% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File. Priority 68.9 of 100.","summary":"Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability","date_published":"2024-04-30T00:00:00.000Z","date_modified":"2026-06-17T07:23:30.000Z","tags":["kev","public-exploit","T1204.002"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2024-04-30","ransomware":false},"epss":{"score":0.45151,"percentile":0.98782},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"SmartScreen Prompt","techniqueIds":["T1204.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-29748","url":"https://patchfirst.co/cve/CVE-2024-29748/","title":"CVE-2024-29748: Android Pixel Privilege Escalation Vulnerability","content_text":"Android · Pixel. In CISA KEV since 2024-04-04. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 52.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 53.9 of 100.","summary":"Android Pixel Privilege Escalation Vulnerability","date_published":"2024-04-05T00:00:00.000Z","date_modified":"2026-06-17T07:23:00.000Z","tags":["kev","T1204.002","T1068"],"_patchfirst":{"reason":"published","priority":53.9,"kev":{"dateAdded":"2024-04-04","ransomware":false},"epss":{"score":0.00676,"percentile":0.52208},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Android","product":"Pixel","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-21351#kev","url":"https://patchfirst.co/cve/CVE-2024-21351/","title":"[KEV] CVE-2024-21351: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-02-13. ENISA EUVD lists it as exploited. EPSS 27.8% (higher than 98.1% of CVEs). CVSS 7.6 HIGH. ATT&CK: T1204.002 Malicious File; T1553.005 Mark-of-the-Web Bypass. Priority 62.9 of 100.","summary":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","date_published":"2024-02-13T00:00:00.000Z","date_modified":"2026-08-10T16:18:42.000Z","tags":["kev","T1204.002","T1553.005"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2024-02-13","ransomware":false},"epss":{"score":0.27798,"percentile":0.9809},"cvss":{"score":7.6,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-41990#kev","url":"https://patchfirst.co/cve/CVE-2023-41990/","title":"[KEV] CVE-2023-41990: Apple Multiple Products Code Execution Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2024-01-08. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.2% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 57.9 of 100.","summary":"Apple Multiple Products Code Execution Vulnerability","date_published":"2024-01-08T00:00:00.000Z","date_modified":"2026-06-17T06:23:12.000Z","tags":["kev","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":57.9,"kev":{"dateAdded":"2024-01-08","ransomware":false},"epss":{"score":0.01388,"percentile":0.72238},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-21608#kev","url":"https://patchfirst.co/cve/CVE-2023-21608/","title":"[KEV] CVE-2023-21608: Adobe Acrobat and Reader Use-After-Free Vulnerability","content_text":"Adobe · Acrobat and Reader. In CISA KEV since 2023-10-10. ENISA EUVD lists it as exploited. EPSS 59.4% (higher than 99.12% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 68.3 of 100.","summary":"Adobe Acrobat and Reader Use-After-Free Vulnerability","date_published":"2023-10-10T00:00:00.000Z","date_modified":"2026-06-17T05:33:17.000Z","tags":["kev","public-exploit","T1204.002","T1203"],"_patchfirst":{"reason":"kev","priority":68.3,"kev":{"dateAdded":"2023-10-10","ransomware":false},"epss":{"score":0.59427,"percentile":0.9912},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Acrobat and Reader","techniqueIds":["T1204.002","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-36563#kev","url":"https://patchfirst.co/cve/CVE-2023-36563/","title":"[KEV] CVE-2023-36563: Microsoft WordPad Information Disclosure Vulnerability","content_text":"Microsoft · WordPad. In CISA KEV since 2023-10-10. ENISA EUVD lists it as exploited. EPSS 20.3% (higher than 97.5% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1204.002 Malicious File; T1005 Data from Local System. Priority 61.3 of 100.","summary":"Microsoft WordPad Information Disclosure Vulnerability","date_published":"2023-10-10T00:00:00.000Z","date_modified":"2026-06-17T06:06:32.000Z","tags":["kev","T1204.002","T1005"],"_patchfirst":{"reason":"kev","priority":61.3,"kev":{"dateAdded":"2023-10-10","ransomware":false},"epss":{"score":0.20318,"percentile":0.97474},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"WordPad","techniqueIds":["T1204.002","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-41991#kev","url":"https://patchfirst.co/cve/CVE-2023-41991/","title":"[KEV] CVE-2023-41991: Apple Multiple Products Improper Certificate Validation Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2023-09-25. ENISA EUVD lists it as exploited. EPSS 13.4% (higher than 96.4% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1553.002 Code Signing. Priority 66.1 of 100.","summary":"Apple Multiple Products Improper Certificate Validation Vulnerability","date_published":"2023-09-25T00:00:00.000Z","date_modified":"2026-06-17T06:23:13.000Z","tags":["kev","public-exploit","T1204.002","T1553.002"],"_patchfirst":{"reason":"kev","priority":66.1,"kev":{"dateAdded":"2023-09-25","ransomware":false},"epss":{"score":0.1338,"percentile":0.96415},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1553.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-26369#kev","url":"https://patchfirst.co/cve/CVE-2023-26369/","title":"[KEV] CVE-2023-26369: Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability","content_text":"Adobe · Acrobat and Reader. In CISA KEV since 2023-09-14. ENISA EUVD lists it as exploited. EPSS 6.7% (higher than 94% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 62.3 of 100.","summary":"Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability","date_published":"2023-09-14T00:00:00.000Z","date_modified":"2026-06-17T05:43:11.000Z","tags":["kev","T1204.002","T1203"],"_patchfirst":{"reason":"kev","priority":62.3,"kev":{"dateAdded":"2023-09-14","ransomware":false},"epss":{"score":0.06746,"percentile":0.93954},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Acrobat and Reader","techniqueIds":["T1204.002","T1203"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-36761#kev","url":"https://patchfirst.co/cve/CVE-2023-36761/","title":"[KEV] CVE-2023-36761: Microsoft Word Information Disclosure Vulnerability","content_text":"Microsoft · Word. In CISA KEV since 2023-09-12. ENISA EUVD lists it as exploited. EPSS 19.6% (higher than 97.4% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1204.002 Malicious File; T1005 Data from Local System. Priority 62.0 of 100.","summary":"Microsoft Word Information Disclosure Vulnerability","date_published":"2023-09-12T00:00:00.000Z","date_modified":"2026-06-17T06:07:01.000Z","tags":["kev","T1204.002","T1005"],"_patchfirst":{"reason":"kev","priority":62,"kev":{"dateAdded":"2023-09-12","ransomware":false},"epss":{"score":0.1957,"percentile":0.97378},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Word","techniqueIds":["T1204.002","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-41064#kev","url":"https://patchfirst.co/cve/CVE-2023-41064/","title":"[KEV] CVE-2023-41064: Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability","content_text":"Apple · iOS, iPadOS, and macOS. In CISA KEV since 2023-09-11. ENISA EUVD lists it as exploited. EPSS 53.4% (higher than 99% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 68.3 of 100.","summary":"Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability","date_published":"2023-09-11T00:00:00.000Z","date_modified":"2026-06-17T06:20:22.000Z","tags":["kev","public-exploit","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":68.3,"kev":{"dateAdded":"2023-09-11","ransomware":false},"epss":{"score":0.53403,"percentile":0.98987},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"iOS, iPadOS, and macOS","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-36884#kev","url":"https://patchfirst.co/cve/CVE-2023-36884/","title":"[KEV] CVE-2023-36884: Microsoft Windows Search Remote Code Execution Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-07-17, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1566 Phishing; T1204.002 Malicious File; T1005 Data from Local System; T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; +1 more. Priority 78.2 of 100.","summary":"Microsoft Windows Search Remote Code Execution Vulnerability","date_published":"2023-07-17T00:00:00.000Z","date_modified":"2026-08-10T16:18:30.000Z","tags":["kev","ransomware","public-exploit","T1566","T1204.002","T1005","T1486","T1489","T1490","T1553.005"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2023-07-17","ransomware":true},"epss":{"score":0.99439,"percentile":0.99942},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566","T1204.002","T1005","T1486","T1489","T1490","T1553.005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-32049#kev","url":"https://patchfirst.co/cve/CVE-2023-32049/","title":"[KEV] CVE-2023-32049: Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-07-11. ENISA EUVD lists it as exploited. EPSS 4.2% (higher than 90.9% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1553.005 Mark-of-the-Web Bypass. Priority 62.3 of 100.","summary":"Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability","date_published":"2023-07-11T00:00:00.000Z","date_modified":"2026-06-17T05:57:57.000Z","tags":["kev","T1204.002","T1553.005"],"_patchfirst":{"reason":"kev","priority":62.3,"kev":{"dateAdded":"2023-07-11","ransomware":false},"epss":{"score":0.04156,"percentile":0.90859},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-30900#kev","url":"https://patchfirst.co/cve/CVE-2021-30900/","title":"[KEV] CVE-2021-30900: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability","content_text":"Apple · iOS, iPadOS, and macOS. In CISA KEV since 2023-03-30. ENISA EUVD lists it as exploited. EPSS 5.2% (higher than 92.5% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 62.0 of 100.","summary":"Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability","date_published":"2023-03-30T00:00:00.000Z","date_modified":"2026-06-17T03:51:06.000Z","tags":["kev","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":62,"kev":{"dateAdded":"2023-03-30","ransomware":false},"epss":{"score":0.05204,"percentile":0.92476},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"iOS, iPadOS, and macOS","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-21823#kev","url":"https://patchfirst.co/cve/CVE-2023-21823/","title":"[KEV] CVE-2023-21823: Microsoft Windows Graphic Component Privilege Escalation Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-02-14. ENISA EUVD lists it as exploited. EPSS 5.6% (higher than 92.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 67.0 of 100.","summary":"Microsoft Windows Graphic Component Privilege Escalation Vulnerability","date_published":"2023-02-14T00:00:00.000Z","date_modified":"2026-08-19T17:18:20.000Z","tags":["kev","public-exploit","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":67,"kev":{"dateAdded":"2023-02-14","ransomware":false},"epss":{"score":0.05563,"percentile":0.92848},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-21715#kev","url":"https://patchfirst.co/cve/CVE-2023-21715/","title":"[KEV] CVE-2023-21715: Microsoft Office Publisher Security Feature Bypass Vulnerability","content_text":"Microsoft · Office. In CISA KEV since 2023-02-14. ENISA EUVD lists it as exploited. EPSS 12.0% (higher than 96.1% of CVEs). CVSS 7.3 HIGH. ATT&CK: T1204.002 Malicious File. Priority 62.3 of 100.","summary":"Microsoft Office Publisher Security Feature Bypass Vulnerability","date_published":"2023-02-14T00:00:00.000Z","date_modified":"2026-08-19T17:18:12.000Z","tags":["kev","T1204.002"],"_patchfirst":{"reason":"kev","priority":62.3,"kev":{"dateAdded":"2023-02-14","ransomware":false},"epss":{"score":0.12011,"percentile":0.96125},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Office","techniqueIds":["T1204.002"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-44698#kev","url":"https://patchfirst.co/cve/CVE-2022-44698/","title":"[KEV] CVE-2022-44698: Microsoft Defender SmartScreen Security Feature Bypass Vulnerability","content_text":"Microsoft · Defender. In CISA KEV since 2022-12-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.002 Malicious File; T1211 Exploitation for Stealth. Named in 1 threat report. Priority 75.6 of 100.","summary":"Microsoft Defender SmartScreen Security Feature Bypass Vulnerability","date_published":"2022-12-13T00:00:00.000Z","date_modified":"2026-06-17T05:08:47.000Z","tags":["kev","ransomware","T1204.002","T1211"],"_patchfirst":{"reason":"kev","priority":75.6,"kev":{"dateAdded":"2022-12-13","ransomware":true},"epss":{"score":0.76267,"percentile":0.99536},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Defender","techniqueIds":["T1204.002","T1211"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-41091","url":"https://patchfirst.co/cve/CVE-2022-41091/","title":"CVE-2022-41091: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-11-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 79.8% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.002 Malicious File; T1553.005 Mark-of-the-Web Bypass. Priority 67.7 of 100.","summary":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","date_published":"2022-11-09T00:00:00.000Z","date_modified":"2026-08-10T16:18:20.000Z","tags":["kev","ransomware","T1204.002","T1553.005"],"_patchfirst":{"reason":"published","priority":67.7,"kev":{"dateAdded":"2022-11-08","ransomware":true},"epss":{"score":0.0191,"percentile":0.79763},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-25337#kev","url":"https://patchfirst.co/cve/CVE-2021-25337/","title":"[KEV] CVE-2021-25337: Samsung Mobile Devices Improper Access Control Vulnerability","content_text":"Samsung · Mobile Devices. In CISA KEV since 2022-11-08. ENISA EUVD lists it as exploited. EPSS 2.8% (higher than 86.5% of CVEs). CVSS 7.1 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1005 Data from Local System. Priority 65.3 of 100.","summary":"Samsung Mobile Devices Improper Access Control Vulnerability","date_published":"2022-11-08T00:00:00.000Z","date_modified":"2026-06-17T03:41:53.000Z","tags":["kev","public-exploit","T1204.002","T1005"],"_patchfirst":{"reason":"kev","priority":65.3,"kev":{"dateAdded":"2022-11-08","ransomware":false},"epss":{"score":0.02807,"percentile":0.86484},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1"},"vendor":"Samsung","product":"Mobile Devices","techniqueIds":["T1204.002","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-42827","url":"https://patchfirst.co/cve/CVE-2022-42827/","title":"CVE-2022-42827: Apple iOS and iPadOS Out-of-Bounds Write Vulnerability","content_text":"Apple · iOS and iPadOS. In CISA KEV since 2022-10-25. ENISA EUVD lists it as exploited. EPSS 1.1% (higher than 64.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 56.4 of 100.","summary":"Apple iOS and iPadOS Out-of-Bounds Write Vulnerability","date_published":"2022-11-01T00:00:00.000Z","date_modified":"2026-06-17T05:05:25.000Z","tags":["kev","T1204.002","T1068"],"_patchfirst":{"reason":"published","priority":56.4,"kev":{"dateAdded":"2022-10-25","ransomware":false},"epss":{"score":0.01062,"percentile":0.64576},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"iOS and iPadOS","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-28949#kev","url":"https://patchfirst.co/cve/CVE-2020-28949/","title":"[KEV] CVE-2020-28949: PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability","content_text":"PEAR · Archive_Tar. In CISA KEV since 2022-08-25. ENISA EUVD lists it as exploited. EPSS 84.6% (higher than 99.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1005 Data from Local System. Priority 78.4 of 100.","summary":"PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability","date_published":"2022-08-25T00:00:00.000Z","date_modified":"2026-06-17T03:10:53.000Z","tags":["kev","public-exploit","T1204.002","T1005"],"_patchfirst":{"reason":"kev","priority":78.4,"kev":{"dateAdded":"2022-08-25","ransomware":false},"epss":{"score":0.84554,"percentile":0.99701},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"PEAR","product":"Archive_Tar","techniqueIds":["T1204.002","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-38406#kev","url":"https://patchfirst.co/cve/CVE-2021-38406/","title":"[KEV] CVE-2021-38406: Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability","content_text":"Delta Electronics · DOPSoft 2. In CISA KEV since 2022-08-25. ENISA EUVD lists it as exploited. EPSS 76.4% (higher than 99.54% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 63.4 of 100.","summary":"Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability","date_published":"2022-08-25T00:00:00.000Z","date_modified":"2026-06-17T04:02:02.000Z","tags":["kev","T1204.002","T1203"],"_patchfirst":{"reason":"kev","priority":63.4,"kev":{"dateAdded":"2022-08-25","ransomware":false},"epss":{"score":0.76428,"percentile":0.9954},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Delta Electronics","product":"DOPSoft 2","techniqueIds":["T1204.002","T1203"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-34713#kev","url":"https://patchfirst.co/cve/CVE-2022-34713/","title":"[KEV] CVE-2022-34713: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-08-09. ENISA EUVD lists it as exploited. EPSS 67.8% (higher than 99.31% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1566 Phishing; T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 63.3 of 100.","summary":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","date_published":"2022-08-09T00:00:00.000Z","date_modified":"2026-06-17T04:50:46.000Z","tags":["kev","T1566","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":63.3,"kev":{"dateAdded":"2022-08-09","ransomware":false},"epss":{"score":0.67757,"percentile":0.99315},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566","T1204.002","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-8605#kev","url":"https://patchfirst.co/cve/CVE-2019-8605/","title":"[KEV] CVE-2019-8605: Apple Multiple Products Use-After-Free Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2022-06-27. ENISA EUVD lists it as exploited. EPSS 17.6% (higher than 97.1% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1068 Exploitation for Privilege Escalation. Priority 67.9 of 100.","summary":"Apple Multiple Products Use-After-Free Vulnerability","date_published":"2022-06-27T00:00:00.000Z","date_modified":"2026-06-17T02:42:14.000Z","tags":["kev","public-exploit","T1204.002","T1068"],"_patchfirst":{"reason":"kev","priority":67.9,"kev":{"dateAdded":"2022-06-27","ransomware":false},"epss":{"score":0.17609,"percentile":0.97145},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}